Re: [PATCH net 4/5] net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

[Joe Damato <joe@dama.to>]

On Wed, Sep 02, 2026 at 08:26:10PM -0700, Jakub Kicinski wrote:
> mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while
> dumping the policy IDR, clobbering the input value before it has been
> looked at.  That input is the number of entries the caller had room for.
> ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the
> buffer from the rule_cnt userspace passes in, so once an admin has
> installed policy rules any user can ask for fewer slots than there are
> rules and run off the end of the allocation.  A rule_cnt of 0 leaves the
> buffer pointer NULL and the walk dereferences it.
> 
> Count into a local so the caller's limit survives the walk, and stop with
> -EMSGSIZE once it is reached.
> 
> Fixes: da7dc8755304 ("net: dsa: mv88e6xxx: add RXNFC support")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: andrew@lunn.ch
> CC: olteanv@gmail.com
> CC: vivien.didelot@gmail.com
> CC: f.fainelli@gmail.com
> ---
>  drivers/net/dsa/mv88e6xxx/chip.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)

Reviewed-by: Joe Damato <joe@dama.to>